I am trying to make a timeline showing different response code ranges being defined. This is the eval I am using, and I want to add the 4 different categories into a timeline dashboard panel. index="stuff" sourcetype="things" src_ip="1.1.1.1" dest_ip="2.2.2.2" | search TERM(attack_vector) | eval Status = case(response_code>="400" OR response_code="0", "Blocked", response_code>="202" AND response_code<="226", "Partial", response_code>="300" AND response_code<="399", "Redirect", response_code="200" OR response_code="201", "Success") I cannot for the life of me figure out what I need to put in the "stats" and "table" portion to make it show a line for each of the created categories!
... View more